# IwoooS 高價值配置 Owner Response Packet

| 項目 | 內容 |
|------|------|
| 日期 | 2026-06-14 |
| 狀態 | `owner_packet_draft_ready_p0_path_sync` |
| 工具 | `scripts/security/high-value-config-owner-packet.py` |
| 輸入 | `docs/security/high-value-config-change-gate.snapshot.json` |
| Snapshot | `docs/security/high-value-config-owner-packet.snapshot.json` |
| runtime gate | `0` |

## 1. 目的

P0.2 已能將變更分類成 C0 / C1 / C2 / C3。本文件與工具負責下一步：把分類結果轉成 owner response packet 草案，讓 Nginx、DNS / TLS、K8s、secret、workflow、runner、backup、monitoring、host service、network、AI provider、agent-bounty-protocol 等高價值配置變更有一致補件欄位。

本階段仍是只讀草案，不送 request、不收 owner response、不標記 received / accepted、不建立 action button、不接 blocking CI、不執行 runtime。

## 1.1 2026-06-14 P0 path sync

本輪 owner packet snapshot 已跟隨高價值配置 Gate 的 P0 pattern 補強重產：

| Packet | affected files | 邊界 |
|--------|----------------|------|
| `nginx_public_gateway` | `k8s/nginx/awoooi-prod.conf` | 只要求 public gateway owner response、rendered diff、`nginx -t` 計畫、route smoke 計畫與 rollback ref，不代表已讀 live conf 或 reload |
| `dns_tls_certbot` | `scripts/ops/188-registry-certbot-fix.sh`、`scripts/ops/fix-188-registry-certbot-renewal.sh` | 只要求 domain / TLS owner response、renewal window、ACME smoke 計畫、public HTTPS smoke 計畫與 rollback ref，不代表 certbot renew 或 DNS / TLS 變更 |
| `security_evidence_tooling` | Gate 文件、snapshot 與工具 | 只要求 snapshot parse、guard smoke、doc secret sanity 與 no runtime gate increase |

重產結果為 `packet_count=3`、`c0_packet_count=2`、`c1_packet_count=0`、`runtime_gate_count=0`；request / received / accepted 仍全部維持 `0`。

## 1.2 2026-06-14 收件預檢

已新增 `docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET-INTAKE-PREFLIGHT.md` 與 `docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json`，將三包草案轉成送件前預檢與 reviewer intake lanes。

目前固定為 `dispatch_preflight_check_count=9`、`reviewer_intake_lane_count=5`、`required_owner_field_total=27`、`blocked_request_count=16`。此 artifact 只表示收件框架已準備，不代表 request sent、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。

## 1.3 2026-06-14 Request draft

已新增 `docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md` 與 `docs/security/high-value-config-owner-request-draft.snapshot.json`，將三包收件預檢轉成人工送件前可核對的 request draft。

目前固定為 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12`。此 artifact 只表示草稿包已準備，不代表 request sent、recipient confirmed、audit event emitted、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。

## 2. Canonical 欄位

高價值配置 packet 對齊 S4.9 canonical owner response envelope，使用以下欄位：

1. `owner_role_or_team`
2. `decision`
3. `decision_reason`
4. `affected_scope`
5. `redacted_evidence_refs`
6. `followup_owner`
7. `rollback_owner`
8. `maintenance_window`
9. `validation_plan`

`decision` 只能是 `confirm`、`defer`、`reject`、`request_more_evidence`。`confirm` 只代表 owner 對該分類補件方向確認，不代表 reload、deploy、sync、scan、payout 或 host write。

## 3. 指令

使用 committed gate snapshot 產生 owner packet：

```bash
python3 scripts/security/high-value-config-owner-packet.py \
  --root . \
  --gate-report docs/security/high-value-config-change-gate.snapshot.json \
  --output docs/security/high-value-config-owner-packet.snapshot.json
```

查看即時分類結果的 packet：

```bash
python3 scripts/security/high-value-config-change-gate.py \
  --root . \
  --changed-file infra/ansible/roles/nginx/templates/188-all-sites.conf.j2 \
  --output /tmp/high-value-config-gate-nginx.json

python3 scripts/security/high-value-config-owner-packet.py \
  --root . \
  --gate-report /tmp/high-value-config-gate-nginx.json
```

## 4. Packet 狀態

| 狀態 | 意義 | Gate 影響 |
|------|------|-----------|
| `draft_waiting_owner_response` | 只是草案，尚未送件或收件 | request / received / accepted 全部維持 0 |
| `request_more_evidence` | owner 欄位缺漏或 scope 不清 | 不增加 accepted |
| `quarantine_sensitive_payload` | 疑似含 secret、token、cookie、private key、未脫敏 evidence | 不保存 raw payload |
| `reject_execution_request` | 夾帶 reload、deploy、sync、host write、scan、payout 等執行要求 | 不建立 action button |
| `ready_for_reviewer_validation` | 欄位完整且無敏感 payload / 執行要求 | 只進 reviewer checklist，仍非 accepted |

## 5. 絕對禁止

1. 不把 packet 草案當成 request sent。
2. 不把 owner 口頭同意當成 response received。
3. 不把 `confirm` 當成 runtime reload / deploy / scan / payout 授權。
4. 不收 secret value、partial token、private key、cookie、session、authorization header、runner token 或 webhook secret。
5. 不把內部工作視窗對話、抱怨或 Session 指令放入前端產品文案。
6. 不用 packet 產生器修改 `.gitea/workflows`、K8s、Nginx、DNS、TLS、主機或 agent-bounty runtime。

## 6. 完成度

| 工作 | 完成度 | 說明 |
|------|--------|------|
| Gate → owner packet 草案 | `100%` | 可從 gate JSON 產生 impacted category packet |
| Canonical 欄位對齊 | `100%` | 已對齊 S4.9 `owner_role_or_team` 等欄位，P0.2 gate 也接受 alias |
| owner response 收件 | `0%` | 尚未送 request、尚未收到 owner response |
| reviewer accepted | `0%` | 尚未進 reviewer checklist |
| runtime gate | `0%` | 未授權且未開啟 |